Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-hy24-6xpe-pkb7
Summary
OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events
## Summary

Heartbeat owner downgrade missed untrusted webhook wake events.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.7 < 2026.4.14`
- Patched versions: `>= 2026.4.14`

## Impact

Heartbeat owner downgrade logic could skip webhook wake events carrying untrusted content, preserving owner-like execution context where the run should have been downgraded.

## Technical Details

The fix includes wake and hook event reasons in owner-downgrade inspection and forces downgrade for untrusted hook wake events.

## Fix

The issue was fixed in #66031. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `31281bc92f55796817a92bc43f722cba1e77ab42`
- PR: #66031

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
Aliases
0
alias CVE-2026-43566
1
alias GHSA-g2hm-779g-vm32
Fixed_packages
0
url pkg:npm/openclaw@2026.4.14
purl pkg:npm/openclaw@2026.4.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-4316-7q9a-xuhx
3
vulnerability VCID-4u3z-rs45-gbhe
4
vulnerability VCID-7akj-469t-57hz
5
vulnerability VCID-a46u-tnbh-fyhs
6
vulnerability VCID-a4jz-y9s4-zkfg
7
vulnerability VCID-dv5s-pvw1-a7fu
8
vulnerability VCID-e25p-j5ed-yqfz
9
vulnerability VCID-gk95-28x9-17dk
10
vulnerability VCID-gkyv-ahk7-1ud3
11
vulnerability VCID-h9a4-1twb-d7d1
12
vulnerability VCID-hz33-9efv-c7ef
13
vulnerability VCID-jshg-1pb2-wbak
14
vulnerability VCID-k8s8-zjv4-gqdb
15
vulnerability VCID-kcy2-a98b-uyg7
16
vulnerability VCID-kxmf-d7w1-xfcv
17
vulnerability VCID-nkh4-j2pe-1qhr
18
vulnerability VCID-p8xd-2um4-9ufr
19
vulnerability VCID-rr6t-1193-ybgz
20
vulnerability VCID-ry1r-br3q-2uaw
21
vulnerability VCID-t2ve-xemk-mqa9
22
vulnerability VCID-vz7k-r7c4-ebfg
23
vulnerability VCID-w2yd-uw91-9yck
24
vulnerability VCID-xj73-kszs-yygp
25
vulnerability VCID-xsct-xjs7-nbab
26
vulnerability VCID-y65g-4baa-a7c2
27
vulnerability VCID-ye4t-n6r3-67ab
28
vulnerability VCID-yhpq-5qy3-y7bn
29
vulnerability VCID-ymmv-2qmq-6kap
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.14
Affected_packages
0
url pkg:npm/openclaw@2026.4.7
purl pkg:npm/openclaw@2026.4.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1pbz-8rnx-dkhe
1
vulnerability VCID-29a1-7ar7-67e1
2
vulnerability VCID-2c8p-gbaw-3ye4
3
vulnerability VCID-2g7x-vu14-nkde
4
vulnerability VCID-2h6a-becf-x7ej
5
vulnerability VCID-2khh-wv8p-97ff
6
vulnerability VCID-2mxq-krq5-bycx
7
vulnerability VCID-3xmj-n798-x3cw
8
vulnerability VCID-3zwq-dz2u-pqgv
9
vulnerability VCID-4316-7q9a-xuhx
10
vulnerability VCID-4u3z-rs45-gbhe
11
vulnerability VCID-4urc-4536-pqhk
12
vulnerability VCID-6wth-qthz-yud8
13
vulnerability VCID-6y5w-am4s-6qa5
14
vulnerability VCID-73cz-n29z-uqem
15
vulnerability VCID-75yr-sbce-nkah
16
vulnerability VCID-7851-2jv5-3qhq
17
vulnerability VCID-7akj-469t-57hz
18
vulnerability VCID-7snr-fn3u-x3b8
19
vulnerability VCID-9hcd-uj62-8yeu
20
vulnerability VCID-9kgh-wj9w-ykff
21
vulnerability VCID-9xgq-vtg2-jucq
22
vulnerability VCID-a46u-tnbh-fyhs
23
vulnerability VCID-a4jz-y9s4-zkfg
24
vulnerability VCID-arks-g6hw-abbw
25
vulnerability VCID-bkya-73v8-bber
26
vulnerability VCID-c25h-khws-2fc3
27
vulnerability VCID-cbuu-4d6c-rben
28
vulnerability VCID-dfdk-dhwf-9yaj
29
vulnerability VCID-dmse-bb22-rkcj
30
vulnerability VCID-dqb2-dej7-augt
31
vulnerability VCID-dv5s-pvw1-a7fu
32
vulnerability VCID-e25p-j5ed-yqfz
33
vulnerability VCID-e4ac-qm17-qbf5
34
vulnerability VCID-fuda-zxu8-gbb4
35
vulnerability VCID-gk95-28x9-17dk
36
vulnerability VCID-gkyv-ahk7-1ud3
37
vulnerability VCID-h9a4-1twb-d7d1
38
vulnerability VCID-haxd-ps1x-h3ch
39
vulnerability VCID-hy24-6xpe-pkb7
40
vulnerability VCID-hz33-9efv-c7ef
41
vulnerability VCID-jshg-1pb2-wbak
42
vulnerability VCID-k8s8-zjv4-gqdb
43
vulnerability VCID-kcy2-a98b-uyg7
44
vulnerability VCID-kxmf-d7w1-xfcv
45
vulnerability VCID-ma62-gtan-97au
46
vulnerability VCID-mszk-dr24-xugw
47
vulnerability VCID-mv8b-cryt-u3g8
48
vulnerability VCID-mxu5-yjqs-nuap
49
vulnerability VCID-nkh4-j2pe-1qhr
50
vulnerability VCID-ns77-4wfj-9ka6
51
vulnerability VCID-ntwt-jkgr-sffu
52
vulnerability VCID-nv6g-7gs9-pfan
53
vulnerability VCID-nw4r-wjgs-8qc1
54
vulnerability VCID-p7gx-9usz-yyew
55
vulnerability VCID-p8xd-2um4-9ufr
56
vulnerability VCID-pae5-uyu7-k3c1
57
vulnerability VCID-pdmd-a4fg-8fcg
58
vulnerability VCID-pj41-sunw-vbcj
59
vulnerability VCID-psms-gauf-tkbz
60
vulnerability VCID-qedr-a3ay-v3gx
61
vulnerability VCID-rr6t-1193-ybgz
62
vulnerability VCID-ry1r-br3q-2uaw
63
vulnerability VCID-t2ve-xemk-mqa9
64
vulnerability VCID-t2yy-9ume-t7be
65
vulnerability VCID-vy8v-np82-r3b5
66
vulnerability VCID-vz7k-r7c4-ebfg
67
vulnerability VCID-w2tj-nqa6-cuam
68
vulnerability VCID-w2yd-uw91-9yck
69
vulnerability VCID-w4p1-sxdg-hyha
70
vulnerability VCID-wmr3-83u3-6qdb
71
vulnerability VCID-wyat-1259-2kg9
72
vulnerability VCID-x2ru-ydpv-f3ah
73
vulnerability VCID-xj73-kszs-yygp
74
vulnerability VCID-xsct-xjs7-nbab
75
vulnerability VCID-y65g-4baa-a7c2
76
vulnerability VCID-ye4t-n6r3-67ab
77
vulnerability VCID-yhpq-5qy3-y7bn
78
vulnerability VCID-ymmv-2qmq-6kap
79
vulnerability VCID-z8mj-pnbe-wqej
80
vulnerability VCID-zg68-u5b5-vkft
81
vulnerability VCID-zpte-tgt5-wqcm
82
vulnerability VCID-zu4s-jnn3-1kd8
83
vulnerability VCID-zunq-wnnf-k3fw
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.7
1
url pkg:npm/openclaw@2026.4.8
purl pkg:npm/openclaw@2026.4.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-2g7x-vu14-nkde
3
vulnerability VCID-2khh-wv8p-97ff
4
vulnerability VCID-2mxq-krq5-bycx
5
vulnerability VCID-3xmj-n798-x3cw
6
vulnerability VCID-4316-7q9a-xuhx
7
vulnerability VCID-4u3z-rs45-gbhe
8
vulnerability VCID-6wth-qthz-yud8
9
vulnerability VCID-6y5w-am4s-6qa5
10
vulnerability VCID-7akj-469t-57hz
11
vulnerability VCID-7snr-fn3u-x3b8
12
vulnerability VCID-9hcd-uj62-8yeu
13
vulnerability VCID-9kgh-wj9w-ykff
14
vulnerability VCID-a46u-tnbh-fyhs
15
vulnerability VCID-a4jz-y9s4-zkfg
16
vulnerability VCID-arks-g6hw-abbw
17
vulnerability VCID-c25h-khws-2fc3
18
vulnerability VCID-dfdk-dhwf-9yaj
19
vulnerability VCID-dqb2-dej7-augt
20
vulnerability VCID-dv5s-pvw1-a7fu
21
vulnerability VCID-e25p-j5ed-yqfz
22
vulnerability VCID-fuda-zxu8-gbb4
23
vulnerability VCID-gk95-28x9-17dk
24
vulnerability VCID-gkyv-ahk7-1ud3
25
vulnerability VCID-h9a4-1twb-d7d1
26
vulnerability VCID-hy24-6xpe-pkb7
27
vulnerability VCID-hz33-9efv-c7ef
28
vulnerability VCID-jshg-1pb2-wbak
29
vulnerability VCID-k8s8-zjv4-gqdb
30
vulnerability VCID-kcy2-a98b-uyg7
31
vulnerability VCID-kxmf-d7w1-xfcv
32
vulnerability VCID-mszk-dr24-xugw
33
vulnerability VCID-mxu5-yjqs-nuap
34
vulnerability VCID-nkh4-j2pe-1qhr
35
vulnerability VCID-ns77-4wfj-9ka6
36
vulnerability VCID-nv6g-7gs9-pfan
37
vulnerability VCID-p8xd-2um4-9ufr
38
vulnerability VCID-pae5-uyu7-k3c1
39
vulnerability VCID-pdmd-a4fg-8fcg
40
vulnerability VCID-pj41-sunw-vbcj
41
vulnerability VCID-qedr-a3ay-v3gx
42
vulnerability VCID-rr6t-1193-ybgz
43
vulnerability VCID-ry1r-br3q-2uaw
44
vulnerability VCID-t2ve-xemk-mqa9
45
vulnerability VCID-t2yy-9ume-t7be
46
vulnerability VCID-vz7k-r7c4-ebfg
47
vulnerability VCID-w2tj-nqa6-cuam
48
vulnerability VCID-w2yd-uw91-9yck
49
vulnerability VCID-wyat-1259-2kg9
50
vulnerability VCID-x2ru-ydpv-f3ah
51
vulnerability VCID-xj73-kszs-yygp
52
vulnerability VCID-xsct-xjs7-nbab
53
vulnerability VCID-y65g-4baa-a7c2
54
vulnerability VCID-ye4t-n6r3-67ab
55
vulnerability VCID-yhpq-5qy3-y7bn
56
vulnerability VCID-ymmv-2qmq-6kap
57
vulnerability VCID-zg68-u5b5-vkft
58
vulnerability VCID-zpte-tgt5-wqcm
59
vulnerability VCID-zu4s-jnn3-1kd8
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.8
2
url pkg:npm/openclaw@2026.4.9-beta.1
purl pkg:npm/openclaw@2026.4.9-beta.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-2g7x-vu14-nkde
3
vulnerability VCID-2khh-wv8p-97ff
4
vulnerability VCID-2mxq-krq5-bycx
5
vulnerability VCID-3xmj-n798-x3cw
6
vulnerability VCID-4316-7q9a-xuhx
7
vulnerability VCID-4u3z-rs45-gbhe
8
vulnerability VCID-6wth-qthz-yud8
9
vulnerability VCID-6y5w-am4s-6qa5
10
vulnerability VCID-7akj-469t-57hz
11
vulnerability VCID-7snr-fn3u-x3b8
12
vulnerability VCID-9hcd-uj62-8yeu
13
vulnerability VCID-9kgh-wj9w-ykff
14
vulnerability VCID-a46u-tnbh-fyhs
15
vulnerability VCID-a4jz-y9s4-zkfg
16
vulnerability VCID-arks-g6hw-abbw
17
vulnerability VCID-c25h-khws-2fc3
18
vulnerability VCID-dfdk-dhwf-9yaj
19
vulnerability VCID-dqb2-dej7-augt
20
vulnerability VCID-dv5s-pvw1-a7fu
21
vulnerability VCID-e25p-j5ed-yqfz
22
vulnerability VCID-fuda-zxu8-gbb4
23
vulnerability VCID-gk95-28x9-17dk
24
vulnerability VCID-gkyv-ahk7-1ud3
25
vulnerability VCID-h9a4-1twb-d7d1
26
vulnerability VCID-hy24-6xpe-pkb7
27
vulnerability VCID-hz33-9efv-c7ef
28
vulnerability VCID-jshg-1pb2-wbak
29
vulnerability VCID-k8s8-zjv4-gqdb
30
vulnerability VCID-kcy2-a98b-uyg7
31
vulnerability VCID-kxmf-d7w1-xfcv
32
vulnerability VCID-mszk-dr24-xugw
33
vulnerability VCID-mxu5-yjqs-nuap
34
vulnerability VCID-nkh4-j2pe-1qhr
35
vulnerability VCID-ns77-4wfj-9ka6
36
vulnerability VCID-nv6g-7gs9-pfan
37
vulnerability VCID-p8xd-2um4-9ufr
38
vulnerability VCID-pae5-uyu7-k3c1
39
vulnerability VCID-pdmd-a4fg-8fcg
40
vulnerability VCID-pj41-sunw-vbcj
41
vulnerability VCID-qedr-a3ay-v3gx
42
vulnerability VCID-rr6t-1193-ybgz
43
vulnerability VCID-ry1r-br3q-2uaw
44
vulnerability VCID-t2ve-xemk-mqa9
45
vulnerability VCID-t2yy-9ume-t7be
46
vulnerability VCID-vz7k-r7c4-ebfg
47
vulnerability VCID-w2tj-nqa6-cuam
48
vulnerability VCID-w2yd-uw91-9yck
49
vulnerability VCID-wyat-1259-2kg9
50
vulnerability VCID-x2ru-ydpv-f3ah
51
vulnerability VCID-xj73-kszs-yygp
52
vulnerability VCID-xsct-xjs7-nbab
53
vulnerability VCID-y65g-4baa-a7c2
54
vulnerability VCID-ye4t-n6r3-67ab
55
vulnerability VCID-yhpq-5qy3-y7bn
56
vulnerability VCID-ymmv-2qmq-6kap
57
vulnerability VCID-zg68-u5b5-vkft
58
vulnerability VCID-zpte-tgt5-wqcm
59
vulnerability VCID-zu4s-jnn3-1kd8
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.9-beta.1
3
url pkg:npm/openclaw@2026.4.9
purl pkg:npm/openclaw@2026.4.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-2g7x-vu14-nkde
3
vulnerability VCID-2khh-wv8p-97ff
4
vulnerability VCID-2mxq-krq5-bycx
5
vulnerability VCID-3xmj-n798-x3cw
6
vulnerability VCID-4316-7q9a-xuhx
7
vulnerability VCID-4u3z-rs45-gbhe
8
vulnerability VCID-6wth-qthz-yud8
9
vulnerability VCID-6y5w-am4s-6qa5
10
vulnerability VCID-7akj-469t-57hz
11
vulnerability VCID-7snr-fn3u-x3b8
12
vulnerability VCID-9hcd-uj62-8yeu
13
vulnerability VCID-9kgh-wj9w-ykff
14
vulnerability VCID-a46u-tnbh-fyhs
15
vulnerability VCID-a4jz-y9s4-zkfg
16
vulnerability VCID-c25h-khws-2fc3
17
vulnerability VCID-dfdk-dhwf-9yaj
18
vulnerability VCID-dqb2-dej7-augt
19
vulnerability VCID-dv5s-pvw1-a7fu
20
vulnerability VCID-e25p-j5ed-yqfz
21
vulnerability VCID-fuda-zxu8-gbb4
22
vulnerability VCID-gk95-28x9-17dk
23
vulnerability VCID-gkyv-ahk7-1ud3
24
vulnerability VCID-h9a4-1twb-d7d1
25
vulnerability VCID-hy24-6xpe-pkb7
26
vulnerability VCID-hz33-9efv-c7ef
27
vulnerability VCID-jshg-1pb2-wbak
28
vulnerability VCID-k8s8-zjv4-gqdb
29
vulnerability VCID-k8x3-9pv7-rfax
30
vulnerability VCID-kcy2-a98b-uyg7
31
vulnerability VCID-kxmf-d7w1-xfcv
32
vulnerability VCID-mszk-dr24-xugw
33
vulnerability VCID-mxu5-yjqs-nuap
34
vulnerability VCID-nkh4-j2pe-1qhr
35
vulnerability VCID-ns77-4wfj-9ka6
36
vulnerability VCID-nv6g-7gs9-pfan
37
vulnerability VCID-p8xd-2um4-9ufr
38
vulnerability VCID-pae5-uyu7-k3c1
39
vulnerability VCID-pj41-sunw-vbcj
40
vulnerability VCID-qedr-a3ay-v3gx
41
vulnerability VCID-rr6t-1193-ybgz
42
vulnerability VCID-rvcq-rqbq-4khp
43
vulnerability VCID-ry1r-br3q-2uaw
44
vulnerability VCID-t2ve-xemk-mqa9
45
vulnerability VCID-t2yy-9ume-t7be
46
vulnerability VCID-vz7k-r7c4-ebfg
47
vulnerability VCID-w2yd-uw91-9yck
48
vulnerability VCID-wyat-1259-2kg9
49
vulnerability VCID-x2ru-ydpv-f3ah
50
vulnerability VCID-xj73-kszs-yygp
51
vulnerability VCID-xsct-xjs7-nbab
52
vulnerability VCID-y65g-4baa-a7c2
53
vulnerability VCID-ye4t-n6r3-67ab
54
vulnerability VCID-yhpq-5qy3-y7bn
55
vulnerability VCID-ymmv-2qmq-6kap
56
vulnerability VCID-zg68-u5b5-vkft
57
vulnerability VCID-zpte-tgt5-wqcm
58
vulnerability VCID-zu4s-jnn3-1kd8
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.9
4
url pkg:npm/openclaw@2026.4.10
purl pkg:npm/openclaw@2026.4.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-2khh-wv8p-97ff
3
vulnerability VCID-2mxq-krq5-bycx
4
vulnerability VCID-3xmj-n798-x3cw
5
vulnerability VCID-4316-7q9a-xuhx
6
vulnerability VCID-4u3z-rs45-gbhe
7
vulnerability VCID-6cfj-zugb-7uhq
8
vulnerability VCID-6wth-qthz-yud8
9
vulnerability VCID-6y5w-am4s-6qa5
10
vulnerability VCID-7akj-469t-57hz
11
vulnerability VCID-9kgh-wj9w-ykff
12
vulnerability VCID-a46u-tnbh-fyhs
13
vulnerability VCID-a4jz-y9s4-zkfg
14
vulnerability VCID-dfdk-dhwf-9yaj
15
vulnerability VCID-dv5s-pvw1-a7fu
16
vulnerability VCID-e25p-j5ed-yqfz
17
vulnerability VCID-gk95-28x9-17dk
18
vulnerability VCID-gkyv-ahk7-1ud3
19
vulnerability VCID-h9a4-1twb-d7d1
20
vulnerability VCID-hphn-8fnj-qkh2
21
vulnerability VCID-hy24-6xpe-pkb7
22
vulnerability VCID-hz33-9efv-c7ef
23
vulnerability VCID-jshg-1pb2-wbak
24
vulnerability VCID-k8s8-zjv4-gqdb
25
vulnerability VCID-kcy2-a98b-uyg7
26
vulnerability VCID-kxmf-d7w1-xfcv
27
vulnerability VCID-nkh4-j2pe-1qhr
28
vulnerability VCID-p8xd-2um4-9ufr
29
vulnerability VCID-q3a2-qk5j-1yat
30
vulnerability VCID-rr6t-1193-ybgz
31
vulnerability VCID-ry1r-br3q-2uaw
32
vulnerability VCID-t2ve-xemk-mqa9
33
vulnerability VCID-t2yy-9ume-t7be
34
vulnerability VCID-vz7k-r7c4-ebfg
35
vulnerability VCID-w2yd-uw91-9yck
36
vulnerability VCID-xj73-kszs-yygp
37
vulnerability VCID-xsct-xjs7-nbab
38
vulnerability VCID-y65g-4baa-a7c2
39
vulnerability VCID-ye4t-n6r3-67ab
40
vulnerability VCID-yhpq-5qy3-y7bn
41
vulnerability VCID-ymmv-2qmq-6kap
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.10
5
url pkg:npm/openclaw@2026.4.11-beta.1
purl pkg:npm/openclaw@2026.4.11-beta.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-2khh-wv8p-97ff
3
vulnerability VCID-2mxq-krq5-bycx
4
vulnerability VCID-3xmj-n798-x3cw
5
vulnerability VCID-4316-7q9a-xuhx
6
vulnerability VCID-4u3z-rs45-gbhe
7
vulnerability VCID-6cfj-zugb-7uhq
8
vulnerability VCID-6wth-qthz-yud8
9
vulnerability VCID-6y5w-am4s-6qa5
10
vulnerability VCID-7akj-469t-57hz
11
vulnerability VCID-9kgh-wj9w-ykff
12
vulnerability VCID-a46u-tnbh-fyhs
13
vulnerability VCID-a4jz-y9s4-zkfg
14
vulnerability VCID-dfdk-dhwf-9yaj
15
vulnerability VCID-dv5s-pvw1-a7fu
16
vulnerability VCID-e25p-j5ed-yqfz
17
vulnerability VCID-gk95-28x9-17dk
18
vulnerability VCID-gkyv-ahk7-1ud3
19
vulnerability VCID-h9a4-1twb-d7d1
20
vulnerability VCID-hphn-8fnj-qkh2
21
vulnerability VCID-hy24-6xpe-pkb7
22
vulnerability VCID-hz33-9efv-c7ef
23
vulnerability VCID-jshg-1pb2-wbak
24
vulnerability VCID-k8s8-zjv4-gqdb
25
vulnerability VCID-kcy2-a98b-uyg7
26
vulnerability VCID-kxmf-d7w1-xfcv
27
vulnerability VCID-nkh4-j2pe-1qhr
28
vulnerability VCID-p8xd-2um4-9ufr
29
vulnerability VCID-rr6t-1193-ybgz
30
vulnerability VCID-ry1r-br3q-2uaw
31
vulnerability VCID-t2ve-xemk-mqa9
32
vulnerability VCID-t2yy-9ume-t7be
33
vulnerability VCID-vz7k-r7c4-ebfg
34
vulnerability VCID-w2yd-uw91-9yck
35
vulnerability VCID-xj73-kszs-yygp
36
vulnerability VCID-xsct-xjs7-nbab
37
vulnerability VCID-y65g-4baa-a7c2
38
vulnerability VCID-ye4t-n6r3-67ab
39
vulnerability VCID-yhpq-5qy3-y7bn
40
vulnerability VCID-ymmv-2qmq-6kap
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.11-beta.1
6
url pkg:npm/openclaw@2026.4.11
purl pkg:npm/openclaw@2026.4.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-2khh-wv8p-97ff
3
vulnerability VCID-2mxq-krq5-bycx
4
vulnerability VCID-3xmj-n798-x3cw
5
vulnerability VCID-4316-7q9a-xuhx
6
vulnerability VCID-4u3z-rs45-gbhe
7
vulnerability VCID-6cfj-zugb-7uhq
8
vulnerability VCID-6wth-qthz-yud8
9
vulnerability VCID-6y5w-am4s-6qa5
10
vulnerability VCID-7akj-469t-57hz
11
vulnerability VCID-9kgh-wj9w-ykff
12
vulnerability VCID-a46u-tnbh-fyhs
13
vulnerability VCID-a4jz-y9s4-zkfg
14
vulnerability VCID-dfdk-dhwf-9yaj
15
vulnerability VCID-dv5s-pvw1-a7fu
16
vulnerability VCID-e25p-j5ed-yqfz
17
vulnerability VCID-gk95-28x9-17dk
18
vulnerability VCID-gkyv-ahk7-1ud3
19
vulnerability VCID-h9a4-1twb-d7d1
20
vulnerability VCID-hphn-8fnj-qkh2
21
vulnerability VCID-hy24-6xpe-pkb7
22
vulnerability VCID-hz33-9efv-c7ef
23
vulnerability VCID-jshg-1pb2-wbak
24
vulnerability VCID-k8s8-zjv4-gqdb
25
vulnerability VCID-kcy2-a98b-uyg7
26
vulnerability VCID-kxmf-d7w1-xfcv
27
vulnerability VCID-nkh4-j2pe-1qhr
28
vulnerability VCID-p8xd-2um4-9ufr
29
vulnerability VCID-rr6t-1193-ybgz
30
vulnerability VCID-ry1r-br3q-2uaw
31
vulnerability VCID-t2ve-xemk-mqa9
32
vulnerability VCID-t2yy-9ume-t7be
33
vulnerability VCID-vz7k-r7c4-ebfg
34
vulnerability VCID-w2yd-uw91-9yck
35
vulnerability VCID-xj73-kszs-yygp
36
vulnerability VCID-xsct-xjs7-nbab
37
vulnerability VCID-y65g-4baa-a7c2
38
vulnerability VCID-ye4t-n6r3-67ab
39
vulnerability VCID-yhpq-5qy3-y7bn
40
vulnerability VCID-ymmv-2qmq-6kap
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.11
7
url pkg:npm/openclaw@2026.4.12-beta.1
purl pkg:npm/openclaw@2026.4.12-beta.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-2khh-wv8p-97ff
3
vulnerability VCID-2mxq-krq5-bycx
4
vulnerability VCID-3xmj-n798-x3cw
5
vulnerability VCID-4316-7q9a-xuhx
6
vulnerability VCID-4u3z-rs45-gbhe
7
vulnerability VCID-6cfj-zugb-7uhq
8
vulnerability VCID-6wth-qthz-yud8
9
vulnerability VCID-6y5w-am4s-6qa5
10
vulnerability VCID-7akj-469t-57hz
11
vulnerability VCID-9kgh-wj9w-ykff
12
vulnerability VCID-a46u-tnbh-fyhs
13
vulnerability VCID-a4jz-y9s4-zkfg
14
vulnerability VCID-dfdk-dhwf-9yaj
15
vulnerability VCID-dv5s-pvw1-a7fu
16
vulnerability VCID-e25p-j5ed-yqfz
17
vulnerability VCID-gk95-28x9-17dk
18
vulnerability VCID-gkyv-ahk7-1ud3
19
vulnerability VCID-h9a4-1twb-d7d1
20
vulnerability VCID-hphn-8fnj-qkh2
21
vulnerability VCID-hy24-6xpe-pkb7
22
vulnerability VCID-hz33-9efv-c7ef
23
vulnerability VCID-jshg-1pb2-wbak
24
vulnerability VCID-k8s8-zjv4-gqdb
25
vulnerability VCID-kcy2-a98b-uyg7
26
vulnerability VCID-kxmf-d7w1-xfcv
27
vulnerability VCID-nkh4-j2pe-1qhr
28
vulnerability VCID-p8xd-2um4-9ufr
29
vulnerability VCID-rr6t-1193-ybgz
30
vulnerability VCID-ry1r-br3q-2uaw
31
vulnerability VCID-t2ve-xemk-mqa9
32
vulnerability VCID-t2yy-9ume-t7be
33
vulnerability VCID-vz7k-r7c4-ebfg
34
vulnerability VCID-w2yd-uw91-9yck
35
vulnerability VCID-xj73-kszs-yygp
36
vulnerability VCID-xsct-xjs7-nbab
37
vulnerability VCID-y65g-4baa-a7c2
38
vulnerability VCID-ye4t-n6r3-67ab
39
vulnerability VCID-yhpq-5qy3-y7bn
40
vulnerability VCID-ymmv-2qmq-6kap
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.12-beta.1
8
url pkg:npm/openclaw@2026.4.12
purl pkg:npm/openclaw@2026.4.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-3xmj-n798-x3cw
3
vulnerability VCID-4316-7q9a-xuhx
4
vulnerability VCID-4u3z-rs45-gbhe
5
vulnerability VCID-6cfj-zugb-7uhq
6
vulnerability VCID-6wth-qthz-yud8
7
vulnerability VCID-7akj-469t-57hz
8
vulnerability VCID-a46u-tnbh-fyhs
9
vulnerability VCID-a4jz-y9s4-zkfg
10
vulnerability VCID-dfdk-dhwf-9yaj
11
vulnerability VCID-dv5s-pvw1-a7fu
12
vulnerability VCID-e25p-j5ed-yqfz
13
vulnerability VCID-gk95-28x9-17dk
14
vulnerability VCID-gkyv-ahk7-1ud3
15
vulnerability VCID-h9a4-1twb-d7d1
16
vulnerability VCID-hphn-8fnj-qkh2
17
vulnerability VCID-hy24-6xpe-pkb7
18
vulnerability VCID-hz33-9efv-c7ef
19
vulnerability VCID-jshg-1pb2-wbak
20
vulnerability VCID-k8s8-zjv4-gqdb
21
vulnerability VCID-kcy2-a98b-uyg7
22
vulnerability VCID-kxmf-d7w1-xfcv
23
vulnerability VCID-nkh4-j2pe-1qhr
24
vulnerability VCID-p8xd-2um4-9ufr
25
vulnerability VCID-rr6t-1193-ybgz
26
vulnerability VCID-ry1r-br3q-2uaw
27
vulnerability VCID-t2ve-xemk-mqa9
28
vulnerability VCID-t2yy-9ume-t7be
29
vulnerability VCID-vz7k-r7c4-ebfg
30
vulnerability VCID-w2yd-uw91-9yck
31
vulnerability VCID-xj73-kszs-yygp
32
vulnerability VCID-xsct-xjs7-nbab
33
vulnerability VCID-y65g-4baa-a7c2
34
vulnerability VCID-ye4t-n6r3-67ab
35
vulnerability VCID-yhpq-5qy3-y7bn
36
vulnerability VCID-ymmv-2qmq-6kap
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.12
9
url pkg:npm/openclaw@2026.4.14-beta.1
purl pkg:npm/openclaw@2026.4.14-beta.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-29a1-7ar7-67e1
1
vulnerability VCID-2c8p-gbaw-3ye4
2
vulnerability VCID-3xmj-n798-x3cw
3
vulnerability VCID-4316-7q9a-xuhx
4
vulnerability VCID-4u3z-rs45-gbhe
5
vulnerability VCID-6cfj-zugb-7uhq
6
vulnerability VCID-6wth-qthz-yud8
7
vulnerability VCID-7akj-469t-57hz
8
vulnerability VCID-a46u-tnbh-fyhs
9
vulnerability VCID-a4jz-y9s4-zkfg
10
vulnerability VCID-dfdk-dhwf-9yaj
11
vulnerability VCID-dv5s-pvw1-a7fu
12
vulnerability VCID-e25p-j5ed-yqfz
13
vulnerability VCID-gk95-28x9-17dk
14
vulnerability VCID-gkyv-ahk7-1ud3
15
vulnerability VCID-h9a4-1twb-d7d1
16
vulnerability VCID-hphn-8fnj-qkh2
17
vulnerability VCID-hy24-6xpe-pkb7
18
vulnerability VCID-hz33-9efv-c7ef
19
vulnerability VCID-jshg-1pb2-wbak
20
vulnerability VCID-k8s8-zjv4-gqdb
21
vulnerability VCID-kcy2-a98b-uyg7
22
vulnerability VCID-kxmf-d7w1-xfcv
23
vulnerability VCID-nkh4-j2pe-1qhr
24
vulnerability VCID-p8xd-2um4-9ufr
25
vulnerability VCID-rr6t-1193-ybgz
26
vulnerability VCID-ry1r-br3q-2uaw
27
vulnerability VCID-t2ve-xemk-mqa9
28
vulnerability VCID-t2yy-9ume-t7be
29
vulnerability VCID-vz7k-r7c4-ebfg
30
vulnerability VCID-w2yd-uw91-9yck
31
vulnerability VCID-xj73-kszs-yygp
32
vulnerability VCID-xsct-xjs7-nbab
33
vulnerability VCID-y65g-4baa-a7c2
34
vulnerability VCID-ye4t-n6r3-67ab
35
vulnerability VCID-yhpq-5qy3-y7bn
36
vulnerability VCID-ymmv-2qmq-6kap
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/openclaw@2026.4.14-beta.1
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-43566
reference_id
reference_type
scores
0
value 0.00147
scoring_system epss
scoring_elements 0.34866
published_at 2026-06-05T12:55:00Z
1
value 0.0016
scoring_system epss
scoring_elements 0.36711
published_at 2026-06-06T12:55:00Z
2
value 0.0016
scoring_system epss
scoring_elements 0.36648
published_at 2026-06-09T12:55:00Z
3
value 0.0016
scoring_system epss
scoring_elements 0.36638
published_at 2026-06-08T12:55:00Z
4
value 0.0016
scoring_system epss
scoring_elements 0.36675
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-43566
1
reference_url https://github.com/openclaw/openclaw
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 6.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openclaw/openclaw
2
reference_url https://github.com/openclaw/openclaw/commit/31281bc92f55796817a92bc43f722cba1e77ab42
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 6.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value 9.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-05T14:28:26Z/
url https://github.com/openclaw/openclaw/commit/31281bc92f55796817a92bc43f722cba1e77ab42
3
reference_url https://github.com/openclaw/openclaw/pull/66031
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 6.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openclaw/openclaw/pull/66031
4
reference_url https://github.com/openclaw/openclaw/security/advisories/GHSA-g2hm-779g-vm32
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value 6.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
3
value 9.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
4
value MODERATE
scoring_system generic_textual
scoring_elements
5
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-05T14:28:26Z/
url https://github.com/openclaw/openclaw/security/advisories/GHSA-g2hm-779g-vm32
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-43566
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 6.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-43566
6
reference_url https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-untrusted-webhook-wake-events
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 6.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
2
value 9.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-05T14:28:26Z/
url https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-untrusted-webhook-wake-events
7
reference_url https://github.com/advisories/GHSA-g2hm-779g-vm32
reference_id GHSA-g2hm-779g-vm32
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g2hm-779g-vm32
Weaknesses
0
cwe_id 184
name Incomplete List of Disallowed Inputs
description The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.
1
cwe_id 863
name Incorrect Authorization
description The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
3
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score4.0 - 9.1
Exploitability0.5
Weighted_severity8.2
Risk_score4.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-hy24-6xpe-pkb7